fix: use correct content type for macOS binary signing #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| build-and-release: | |
| runs-on: sre-eqx-kata | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Install zip | |
| run: | | |
| for i in 1 2 3; do | |
| sudo apt-get install -y zip && break | |
| echo "Attempt $i failed, retrying in 5s..." | |
| sleep 5 | |
| done | |
| - run: bun install | |
| - run: bun run typecheck | |
| - run: bun test | |
| - run: bun run bundle:all | |
| - name: Download Codesign Client and signatures | |
| run: | | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256.asc | |
| - name: Import GPG public key | |
| run: | | |
| mkdir -p ~/.gnupg | |
| chmod 700 ~/.gnupg | |
| echo "batch" > ~/.gnupg/gpg.conf | |
| echo "no-tty" >> ~/.gnupg/gpg.conf | |
| echo "no-autostart" >> ~/.gnupg/gpg.conf | |
| curl -o - https://download-cdn.jetbrains.com/KEYS | gpg --batch --no-tty --no-autostart --import - | |
| - name: Verify SHA256 file signature | |
| run: | | |
| gpg --batch --no-tty --no-autostart --verify codesign-client-linux-amd64.sha256.asc codesign-client-linux-amd64.sha256 | |
| - name: Verify SHA256 checksum | |
| run: | | |
| sha256sum -c codesign-client-linux-amd64.sha256 | |
| chmod +x codesign-client-linux-amd64 | |
| - name: Sign Windows binary | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 -extensions "jsign_replace=true" dist/bin/codex-acp-x64-windows.exe | |
| - name: Sign macOS binaries | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-bin" \ | |
| -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \ | |
| dist/bin/codex-acp-x64-darwin | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-bin" \ | |
| -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \ | |
| dist/bin/codex-acp-arm64-darwin | |
| - run: bun run package:all | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| dist/bin/codex-acp-x64-linux.zip | |
| dist/bin/codex-acp-arm64-linux.zip | |
| dist/bin/codex-acp-x64-darwin.zip | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| dist/bin/codex-acp-x64-windows.zip | |
| generate_release_notes: true |